evilcode.win - robtex.com

πŸ›‘οΈDomain Reputation CheckBlocklist, phishing & malware statusβ†’

evilcode.win

DNSSEC⚠️ Not signed
A2606:4700:3034::6815:4613πŸ‡ΊπŸ‡Έ Cloudflare2606:4700:3034::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US βœ“ In HTTPS hints
A2606:4700:3037::ac43:d9eeπŸ‡ΊπŸ‡Έ Cloudflare2606:4700:3037::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US βœ“ In HTTPS hints
A104.21.70.19Cloudflare104.21.64.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US βœ“ In HTTPS hints
A172.67.217.238πŸ‡ΊπŸ‡Έ Cloudflare172.67.208.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US βœ“ In HTTPS hints
NSbowen.ns.cloudflare.com ⭐
A2606:4700:58::a29f:2c53πŸ‡ΊπŸ‡Έ Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRbowen.ns.cloudflare.com
A2803:f800:50::6ca2:c353πŸ‡¨πŸ‡· Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L
PTRbowen.ns.cloudflare.com
A2a06:98c1:50::ac40:2353πŸ‡ΊπŸ‡Έ Cloudflare2a06:98c1:50::/45
PTRbowen.ns.cloudflare.com
A108.162.195.83πŸ‡ΊπŸ‡Έ Cloudflare108.162.195.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRbowen.ns.cloudflare.com
A162.159.44.83Cloudflare162.159.32.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRbowen.ns.cloudflare.com
A172.64.35.83πŸ‡ΊπŸ‡Έ Cloudflare172.64.35.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRbowen.ns.cloudflare.com
NSnucum.ns.cloudflare.com
A2606:4700:50::a29f:2691πŸ‡ΊπŸ‡Έ Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRnucum.ns.cloudflare.com
A2803:f800:50::6ca2:c291πŸ‡¨πŸ‡· Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L
PTRnucum.ns.cloudflare.com
A2a06:98c1:50::ac40:2291πŸ‡ΊπŸ‡Έ Cloudflare2a06:98c1:50::/45
PTRnucum.ns.cloudflare.com
A108.162.194.145πŸ‡ΊπŸ‡Έ Cloudflare108.162.194.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRnucum.ns.cloudflare.com
A162.159.38.145Cloudflare162.159.32.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRnucum.ns.cloudflare.com
A172.64.34.145πŸ‡ΊπŸ‡Έ Cloudflare172.64.34.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRnucum.ns.cloudflare.com
MXmx2.zoho.eu ⭐
A185.230.214.166πŸ‡³πŸ‡± ZOHO-EU185.230.214.0/23
PTRmx2.zoho.eu
PTRmx3.zoho.eu
PTRmx.zoho.eu
MXmx3.zoho.eu(20)
A185.230.212.166πŸ‡³πŸ‡± ZOHO-EU185.230.212.0/23
PTRmx2.zoho.eu
PTRmx3.zoho.eu
PTRmx.zoho.eu
MXmx.zoho.eu(50)
A185.230.212.166πŸ‡³πŸ‡± ZOHO-EU185.230.212.0/23
PTRmx2.zoho.eu
PTRmx3.zoho.eu
PTRmx.zoho.eu
A185.230.214.166πŸ‡³πŸ‡± ZOHO-EU185.230.214.0/23
PTRmx2.zoho.eu
PTRmx3.zoho.eu
PTRmx.zoho.eu
TXTv=spf1 include:zoho.eu ~all
HTTPSHTTP/3, HTTP/2 βœ“ hints match
IPv4 hints104.21.70.19, 172.67.217.238
IPv6 hints2606:4700:3034::6815:4613, 2606:4700:3037::ac43:d9ee
ECHX25519, HKDF-SHA256 + AES-128-GCM draft, id=208, name=cloudflare-ech.com
SOAbowen.ns.cloudflare.comdns@cloudflare.com serial=2415898619

win

DNSSECπŸ”’ Signed (DS record present)
NSns1.dns.nic.win ⭐
NSa.nic.win
NSb.nic.win
NSc.nic.win
NSns2.dns.nic.win
NSns3.dns.nic.win
SOAns1.dns.nic.winadmin@tldns.godaddy serial=1790798554
⚠️ On DNS blocklist: spam-tlds

Same first word

Similar names

Previous names

Next names

DNS History

9 records (9 active, 0 former)

NSbowen.ns.cloudflare.comnucum.ns.cloudflare.comMXmx.zoho.eumx2.zoho.eumx3.zoho.euA104.21.70.19172.67.217.2382606:4700:3034::6815:46132606:4700:3037::ac43:d9ee
●NSbowen.ns.cloudflare.com2026-09-26 β†’ 2026-09-30 Β· 2 obs
● 2026-09-26 08:57:24
● 2026-09-30 20:38:32
●NSnucum.ns.cloudflare.com2026-09-26 β†’ 2026-09-30 Β· 2 obs
● 2026-09-26 08:57:24
● 2026-09-30 20:38:32
●MXmx.zoho.eu2026-09-26 β†’ 2026-09-30 Β· 2 obs
● 2026-09-26 08:57:24
● 2026-09-30 20:38:32
●MXmx2.zoho.eu2026-09-26 β†’ 2026-09-30 Β· 2 obs
● 2026-09-26 08:57:24
● 2026-09-30 20:38:32
●MXmx3.zoho.eu2026-09-26 β†’ 2026-09-30 Β· 2 obs
● 2026-09-26 08:57:24
● 2026-09-30 20:38:32
●A104.21.70.192026-09-26 β†’ 2026-09-30 Β· 2 obs
● 2026-09-26 08:57:24
● 2026-09-30 20:38:32
●A172.67.217.2382026-09-26 β†’ 2026-09-30 Β· 2 obs
● 2026-09-26 08:57:24
● 2026-09-30 20:38:32
●A2606:4700:3034::6815:46132026-09-26 β†’ 2026-09-30 Β· 2 obs
● 2026-09-26 08:57:24
● 2026-09-30 20:38:32
●A2606:4700:3037::ac43:d9ee2026-09-26 β†’ 2026-09-30 Β· 2 obs
● 2026-09-26 08:57:24
● 2026-09-30 20:38:32

πŸ” DNS Trace

πŸ“‹ Delegation Chain

ZoneNameserversGlue
winc.nic.win, ns1.dns.nic.win, a.nic.win, ns3.dns.nic.win...-
evilcode.winnucum.ns.cloudflare.com, bowen.ns.cloudflare.com-

βœ… Authoritative Response

Server:162.159.44.83

NS records: nucum.ns.cloudflare.com, bowen.ns.cloudflare.com

πŸ”’ DNSSEC Status

⚠️ Insecure (no DNSSEC)

No DS record for evilcode.win (unsigned zone)

⏱️ Timing

Total: 702ms | Queries: -

πŸ“„ Records

TypeCountSample Data
A2172.67.217.238, 104.21.70.19
AAAA22606:4700:3037::ac43:d9ee, 2606:4700:3034::6815:4613
NS2bowen.ns.cloudflare.com, nucum.ns.cloudflare.com
MX3mx.zoho.eu (pri: 10), mx2.zoho.eu (pri: 20)...
TXT1v=spf1 include:zoho.eu ~all
HTTPS1{"priority":1,"target":".","alpn":["h3",
SOA1bowen.ns.cloudflare.com dns.cloudflare.c

Analysis

IP Addresses

evilcode.win directs to four IP numbers, which are 104.21.70.19, 172.67.217.238, 2606:4700:3034::6815:4613 and 2606:4700:3037::ac43:d9ee.

Two other host names, along with shreeruh.com, mashnlearn.com and dewi11jpex.site, also share IP numbers with evilcode.win.

Name Servers

Two name servers handle the delegation for evilcode.win: bowen.ns.cloudflare.com and nucum.ns.cloudflare.com.

evilcode.win shares its NS records with other domains, for example prestigecasino-uk.co.uk, x951.buzz, 8310w.pages.dev and two others.

At least some of evilcode.win's name servers are shared with other domains, for example dinerolistoglobal.com, storebeeper.com, gwpmozambique.org and two more.

These name servers tend to be deployed in combination with the name servers lloyd.ns.cloudflare.com and thaddeus.ns.cloudflare.com.

DNS names with 6 IP addresses:

bowen.ns.cloudflare.com resolves to 108.162.195.83, 162.159.44.83 and 172.64.35.83 among others, with 3 other IP addresses in total.

nucum.ns.cloudflare.com resolves to 108.162.194.145, 162.159.38.145 and 172.64.34.145 among others, with 3 other IP addresses in total.

Mail Servers

The MX records for evilcode.win list three mail servers: mx2.zoho.eu, mx3.zoho.eu and mx.zoho.eu.

There is at least a partial MX overlap between evilcode.win and other domains, including ngly.de, timzar.es, genelous.com and two others.

Host names that have two IP addresses:

mx.zoho.eu resolves to two addresses: 185.230.212.166 and 185.230.214.166.

Host names that point to one IP address:

The hostname mx2.zoho.eu resolves to 185.230.214.166.

The hostname mx3.zoho.eu resolves to 185.230.212.166.

mx.zoho.eu along with mx3.zoho.eu each resolve to 185.230.212.166 IP addresses.

mx.zoho.eu along with mx2.zoho.eu each resolve to 185.230.214.166 IP addresses.